feat: skill expansion — browser, security, SQL, files (16 skills total)

Novas skills instaladas:
- openclaw-agent-browser   v1.0.0  CLI Chromium — navegação, login, screenshots, state
- skill-security-audit    v1.0.0  SAST scanning, prompt injection, secrets audit
- sql-toolkit             v1.0.0  PostgreSQL/MySQL/SQLite — schema, query, otimização
- file                    v1.0.0  Organização de arquivos por contexto
- file-summary            v1.0.0  Extração e resumo de PDFs, Word, Excel

Workspace expandido:
- TOOLS.md: +Browser automation, Security audit, SQL, File management
- AGENTS.md: +Linux Analyst section (comandos, logs, rede, scripts) + Full-stack strategy
- MEMORY.md: 16 skills indexadas, stack map, comandos Linux ref
- SESSION-STATE.md: atualizado com contexto completo
- lock.json: sincronizado com 16 skills instaladas

skills/xcloud-docker-deploy/references/xcloud-constraints.md

@@ -0,0 +1,56 @@
+# xCloud Docker Deployment — Constraints & Architecture
+
+## Architecture
+
+```
+Internet → Cloudflare → xCloud Nginx (port 443, SSL) → Docker container (single exposed port)
+```
+
+xCloud manages:
+- SSL/TLS termination (via Let's Encrypt or Cloudflare)
+- Reverse proxy (nginx)
+- Domain routing
+
+Your Docker stack must NOT include: Caddy, Traefik, nginx-proxy, or any SSL-terminating proxy.
+
+## xCloud Git Deployment Behavior
+
+When you push to git, xCloud runs:
+```bash
+git pull
+docker-compose pull   # pulls images from registry — does NOT build
+docker-compose up -d
+```
+
+**Critical:** xCloud never runs `docker build`. Images must be pre-built and available in a public registry.
+
+## docker-compose.yml Constraints
+
+| Rule | Detail |
+|------|--------|
+| Single file only | No external `.conf`, `.env`, or override files at deploy time |
+| Public images only | All `image:` must reference a public registry (`docker.io`, `ghcr.io`, etc.) |
+| No `build:` directives | Will be silently ignored or fail |
+| Single exposed port | One port proxied by xCloud's nginx |
+| Env vars via UI | Set in xCloud dashboard, not in compose |
+| Volume paths | Use relative paths; xCloud sets working directory to repo root |
+
+## Deployment Steps in xCloud
+
+1. Server → New Site → Custom Docker
+2. Connect git repo (GitHub/GitLab/Bitbucket)
+3. Paste `docker-compose.yml` or point to repo file
+4. Set exposed port (the port xCloud proxies to)
+5. Add env vars in xCloud UI
+6. Deploy
+
+## Supported Public Registries
+
+- `ghcr.io` (GitHub Container Registry) — free for public repos
+- `docker.io` / `hub.docker.com` — free for public images
+- `registry.gitlab.com` — GitLab registry
+- Any public registry URL
+
+## Environment Variables
+
+Never hardcode secrets in `docker-compose.yml`. Use `${VAR_NAME}` syntax — xCloud injects them via the UI. Always provide a `.env.example` listing all required variables.